Insecure Direct Object Reference in Frontend File Manager Plugin for WordPress
CVE-2025-13382
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 November 2025
What is CVE-2025-13382?
The Frontend File Manager Plugin for WordPress contains a serious vulnerability due to improper validation of file ownership. This issue affects all versions up to and including 23.4. Specifically, it arises in the '/wpfm/v1/file-rename' REST API endpoint, allowing authenticated attackers with Subscriber-level access and above to rename files uploaded by others through manipulation of the 'fileid' parameter. This oversight poses significant security risks as it enables unauthorized control over files, potentially leading to data breaches or misuse.
Affected Version(s)
Frontend File Manager Plugin * <= 23.4